CVE-2026-54256

Winter CMS (v1.2.12 and earlier) contains an Insecure Direct Object Reference (IDOR) in the backend FileUpload form widget. The widget's getFileRecord() resolved a user-supplied file_id POST parameter against the global system_files table without scoping to the widget's own relation or parent rec...

CVE-2026-54256 Winter: Authenticated IDOR in backend FileUpload widget allows cross-user access to attachment metadata

Winter CMS is a content management system built on the Laravel PHP framework. In versions up to and including 1.2.12, the backend FileUpload form widget trusted an attacker-controlled fileid POST parameter when resolving the attachment it operates on, allowing an authenticated backend user to rea...

CVE-2026-54256 Winter: Authenticated IDOR in backend FileUpload widget allows cross-user access to attachment metadata

Winter CMS is a content management system built on the Laravel PHP framework. In versions up to and including 1.2.12, the backend FileUpload form widget trusted an attacker-controlled fileid POST parameter when resolving the attachment it operates on, allowing an authenticated backend user to rea...

Winter: Authenticated IDOR in backend FileUpload widget allows cross-user access to attachment metadata

Impact The backend FileUpload form widget trusted an attacker-controlled fileid POST parameter when resolving the attachment it operates on. The lookup FileUpload::getFileRecord resolved the posted id against the global systemfiles table without verifying that the file belonged to the widget's ow...

GHSA-3277-H8G9-QJ5F Winter: Authenticated IDOR in backend FileUpload widget allows cross-user access to attachment metadata

Impact The backend FileUpload form widget trusted an attacker-controlled fileid POST parameter when resolving the attachment it operates on. The lookup FileUpload::getFileRecord resolved the posted id against the global systemfiles table without verifying that the file belonged to the widget's ow...

PT-2026-80755

Name of the Vulnerable Software and Affected Versions Winter CMS versions prior to 1.2.13 Description The backend FileUpload form widget improperly trusts the file id POST parameter when resolving attachments. The getFileRecord function resolves the provided ID against the global system files tab...